HyeongminSeo / iphone-dataprotection

Automatically exported from code.google.com/p/iphone-dataprotection
0 stars 0 forks source link

Change serial number #69

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
Iphone 4 after replace dead nand chip can not activate/
Apple server check the serial and imei and they do not match the data in the 
database

I read full nand dump, but i cant find in hex the serial. 
At What Address in memory is programmed serial number? And if it is encrypted 
by one of the keys?
Thank you.

Original issue reported on code.google.com by crashnok...@gmail.com on 20 Aug 2012 at 3:26

GoogleCodeExporter commented 8 years ago
The serial number is in the DEVICEUNIQUEINFO special pages which are stored at 
the "end" of the NAND. Those pages are encrypted with the metadata key.
The code at 
http://code.google.com/p/iphone-dataprotection/source/browse/python_scripts/nand
/nand.py#229 reads the special blocks/pages
and  the code at 
http://code.google.com/p/iphone-dataprotection/source/browse/python_scripts/nand
/nand.py#116
 shows the serial number when you open the nand image in ios_examiner.

Modifying those pages seems a bit dangerous and it will probably brick the 
device is incorrect data is written (i think the wifi calibration data is 
stored there as well). If you want to experiment you'll have to use an ios4 
kernel which should allow the write functionality of [ioflashstoragetool]. Try 
it at your own risks !

Original comment by jean.sig...@gmail.com on 21 Aug 2012 at 9:19

GoogleCodeExporter commented 8 years ago
Thanks for the great advice on writing code in NAND with IOS 4 patched kernel. 
Because I just could not flash anything to NAND with 5.1.1 kernel.
I'm not afraid ruin something in DEVICEUNIQUEINFO, because these devices are 
already bricks. And a serial number does not match the imei in the modem (at 
the base of apple)
These Nand flashes are taken from the completely dead motherboards and Wi fi 
works, the only problem is the inability of activation.
Thank you again

Original comment by crashnok...@gmail.com on 21 Aug 2012 at 11:32